Video: Data Recovery of Flash Devices with Monolithic Chips

Monolithic flash storage is being used in more and more devices like thumb drives and camera cards. It saves space, but can the data be saved from it if something goes wrong?
Click the play button to find out!

Watch more videos from DriveSavers.

Transcript of interview with Will DeLisi, DriveSavers NAND Flash Data Recovery Specialist

So you have two types of flash setups—two main types. So this would be one with a controller. As you can see, these TSOPs are removed from the board. There were four total—we’re reading one right now—and this is the controller. Normally, what happens when these fail is the controller’s firmware is corrupt or the controller no longer responds or it puts out invalid data.
So, on the other hand, then you have monolithic memory like this guy and this guy. So it’s essentially the same thing. You’ll have memory chips like this inside of them—they’re just very, very small. And you’ll also have a controller inside of here that’s very, very small. So you can’t read them individually.
Where these TSOPs have dedicated pinouts. These pins never never change from 8-bit TSOPs. It will change from 16-bit but they’re still the same if they’re 16-bit. So you never have to worry about them being any different. Whereas, on here they’ll always be different. They may have different pad arrangements. They may have different V arrangements. But they’re almost always going to be completely different. So you have to analyze them before you can start reading.
These, we can start reading. And I know what kind of controller this is, so I have an advantage in the sense of being able to reconstruct it a little quicker than usual. On these, you’re flying blind for the most part.
This is actually just one piece from the flash drive. These have one or sometimes two chips. They’re still small but this type of monolith is probably gonna be as wide as the USB itself. And if you see that blue piece in there—that would be where that starts and typically they’re about that big. And they’re used far more frequently now. It’s cheaper to manufacture and people want smaller and easier, more portable devices.
First step is shaving off all of the backing—the coating on it. And then once that’s done, use a multimeter to figure out which signals may be the data port. It’s 8-bit, so you’re gonna have eight that basically range in the same resistance. And then the other ones are sort of a shot in the dark and you’re guessing at it. And so then once that’s done, I would solder each pad that I’ve identified that aren’t duplicate pads to the areas on here that are one through sixteen. And once that’s finished, I will plug a logic analyzer into the computer and run that to pull a scan of each individual pad. From then on, I can tell—by looking at the different signals that come out—I can tell which ones are the 8-bit data ports as well as figure out where your ALE, CLE, CE0,1, 2, RE, RB—figure out all those signals. And then, after that I still have to figure out which order that eight data bits go in. And once I figure that out, then I desolder everything else and resolder it to the exact positioning where you can see now that I have done that. And then I can pull a raw dump. And that’s about twenty-five percent of the work. And then I’ve got to still reconstruct it logically.
So first, you map out sixteen and if you need additional pins—for instance if you have more banks or crystals inside the chip—then you’ll do it again and you’ll just find out where the other banks or other crystals are located. Since you only have sixteen channels on the logic analyzers, you might have to do it multiple times to find more signals.
This is just the signals when it first puts power into it, and the signals that come out of it. So I got to figure out which one is which and then group them into, for instance, I group all the data up here and then I’ll name them. Instead of “channel 6”, I’ll name it, you know, i01, i02, i03, i04. And then, you know, my CEs and RBs all at the bottom. So once I figured that out, then I know where the pins go. And then I remap them on here to this specific signal.
But with monoliths, you have to do the logic analysis, then you have to pull the raw data dump and then put it back together flying blind, not knowing what type of controller it may be using. You can kind of see some signals. You might get an idea of what manufacturer controller by looking at the raw data and bitmap, but for the most part you’re not gonna know what controller it is. So it’s even more work.
So you have a raw data dump and that’s not data for the customer. You have to be able to figure out how to turn that into logical blocks and put them in order.